Lead high-severity incident response, threat hunting, containment, and forensic investigations, including analysis of memory, disks, system logs, malware, and network traffic. Preserve legally admissible evidence, reconstruct attack timelines, produce investigation reports, and coordinate breach compliance matters with legal and GRC teams.
This is a remote position.
Digital Forensics and Incident Response (DFIR) Specialist
Job Details
Employment Type: Contract
Work Mode: Remote
Location: Offshore
Total Experience Required: 5 to 8 years
Relevant Experience Required: 4+ years of dedicated experience conducting digital forensics investigations and deep incident response execution
We are seeking an experienced DFIR Specialist to lead our post-breach investigation pipelines, threat containment lifecycles, and digital forensics operations. The ideal candidate will isolate compromised systems, perform low-level disk and memory trace analyses, reconstruct complex attack timelines, and preserve legally admissible digital evidence to help the business understand and recover from advanced cyber incidents.
Key Responsibilities
Direct high-severity incident response lifecycles, spearheading rapid threat hunting sweeps, system isolations, and malicious compromise containment operations across the global network.
Perform deep digital forensic investigations, analyzing live volatile host memory dumps, master file tables (MFT), system registries, and volatile kernel memory layers.
Reconstruct chronological threat attack timelines, tracing advanced persistence methods, command-and-control (C2) callback patterns, lateral network movements, and data exfiltration markers.
Enforce rigid chain-of-custody data preservation parameters, collecting digital image snapshots of target drives and network captures in compliance with international legal and evidentiary standards.
Analyze complex malware behaviors and payload scripts, reverse engineering malicious scripts, unpacking obfuscated code loops, and translating findings into actionable local indicator blocks (IOCs).
Author detailed forensic investigation runbooks and expert reports, presenting clear summaries of breach roots, compromised asset matrices, data exposure volumes, and recovery steps to legal and executive stakeholders.
Collaborate with GRC and legal compliance teams, evaluating data breach notification requirements in accordance with corporate mandates and regional privacy laws (e.g., GDPR, HIPAA).
Requirements
5 to 8 years of core cybersecurity systems engineering experience, with 4+ dedicated years actively running complex post-breach digital forensic track assessments.
Deep structural understanding of file system layout matrices (NTFS, EXT4, FAT), operating system log architectures, network layer packet capture parsing, and malware persistence mechanics.
Mandatory certification: GCFA, GCIH, or CCE.
Preferred Qualifications
Prior experience dealing with ransomware negotiations or navigating high-stakes ransomware containment events under tight timeline expectations.
Scripting background in Python or Perl used to build custom string searching queries or parse non-standard database application trace files.
“I was the first applicant for a remote marketing position that got listed on the company website the same day I applied. Had an interview within 48 hours!”
— Sarah J.
·
Marketing Manager
★★★★★
Verified
